Earlier today, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These releases fix two crucial vulnerabilities that, under the correct conditions, authorize an unauthenticated attacker to execute code on servers operating PHP. If you run PHP, it is imperative that you update now. The announcement on php.net contains and references specialized particulars on the vulnerabilities, assault vectors, and instructions on how to update on which systems.
This article isn't concerning how to update. It's concerning how these vulnerabilities were established and fixed, what has changed in how PHP safety is handled complete the former two years, and what we need from the organizations that depend on PHP to keep PHP's safety activity going.
- CVE-2026-109618 / GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (out-of-memory): If a petition reached PHP's memory_limit at exactly the incorrect moment, PHP could depart partially initialized inner data rearward and afterward treat it as valid, corrupting memory. On Apache alongside mod_php, an unauthenticated petition can trigger this before any use code runs, and complete distant code implementation was demonstrated alongside default settings. Remote code implementation was additionally confirmed on PHP-FPM through application-level code paths.
- CVE-2026-109619 / GHSA-6wmf-4rv5-p3rp: RCE via old state: A fatal error at the incorrect item could depart inner province pointing to recollection that belonged to a former request. A afterward petition handled by the identical employee could afterward use that freed memory. A use-after-free and employee collision were confirmed, and the newsman demonstrated distant code implementation against a real-world use operating on Apache alongside mod_php.
Both issues sit in parts of PHP that nearly all petition touches: recollection administration and error handling. Their chief location in PHP is what made the two vulnerabilities serious, and additionally so difficult to fix without breaking compatibility, hurting performance, or forcing changes on the ample ecosystem of third-party extensions.
A archetypal external audit and risen safety focus
In 2024, PHP underwent its archetypal external safety audit in years. The PHP Foundation secured backing from the Sovereign Tech Agency to arrange this audit through OSTIF, and it was carried out by Quarkslab. While fixing among the issues Quarkslab reported, a PHP center developer contracted by the PHP Foundation established the archetypal signs of the OOM issue rearward CVE-2026-109618. In 2024, a possible utilize for the OOM issue was theorized, but no tangible vectors were established and another tangible issues alongside apparent effect overshadowed these concerns.
To fix the OOM problem, the PHP safety squad developed multiple competing approaches, but all came alongside its own trade-offs: backward compatibility breaks, new denial-of-service potential, or requiring changes to many third-party extensions which seemed unattainable to coordinate. The PHP safety team, functioning on consensus, struggled to choose between these and feared the repercussions of shipping the incorrect choice. Combined alongside the deficiency of a known way to distant code implementation and the small squad of center developers alongside the necessary profound cognition of the motor occupied alongside many responsibilities, this decision procedure caused activity on a fix to stall and restart often complete months. We won't feign otherwise: the postpone was a structural failure, caused by the two the safety team's decision procedure and its deficiency of resources. The safety squad has since started changing its processes, and that activity continues, so that decisions can be made by bulk and compromises are encouraged.
Building a sustainable expert safety organization
Over the final months the way PHP safety activity is organized has changed considerably. In May 2026, the PHP Foundation created the Ecosystem Security Team, which plant alongside the PHP safety squad on triage, coordination, and hardening. Volker Dusch's activity as AI Security Engineer in Residence at the PHP Foundation has considerably improved communication and collaboration between the PHP safety squad and the Foundation. Alexandre Daubois joined the PHP Foundation in July to assistance the PHP safety squad triage, handle, and fix safety reports and Daniel Scherzer joined in September to obtain on hardening work.
Earlier this year, we worked alongside Alpha-Omega to scan PHP alongside Anthropic's Claude Mythos. But since the Mythos scan, we have added another tools, including OpenAI's Daybreak Red for validating reports and exploits, alongside sanitizer builds and reproduction environments that equivalent our CI on all phase PHP supports.
The PHP Foundation got the PHP project into the Patch the Planet program, as part of which safety resolute Calif began an audit of PHP on July 30th, 2026. On August 11th investigator Ryan A at Calif reported an unconditional distant code implementation alongside the identical base logic as the OOM issue we had established in 2024. OpenAI independently reported the identical base logic on the identical day, followed by additional assault vectors from OpenAI on September 18th and from Wiz on August 24th. More recently, Trail of Bits has additionally been auditing PHP. The reports from Calif, OpenAI, and Wiz made the complete effect of the OOM issue clear, and from August 11th onward, fixing it became the top precedence for all of the PHP Foundation's squad operating on security. Without the Foundation’s backing it would have been unattainable to have multiple group activity on this matter complete time, eventually through weekends and about the clock to coordinate and communicate alongside another engaged parties.
The growth of AI-assisted investigation additionally method the PHP safety squad receives far additional reports than before. As Alexandre Daubois described final week in How the PHP Security Team Handles Your Reports, the squad has published 15 CVEs since July 1st and worked through additional than 100 reports that turned out to be invalid, duplicates, or not reproducible. AI helps the squad validate reports and collection reports sharing the identical base cause, but a individual makes all call and plant on all patch.
Leak and disrupted disclosure
The coordinated disclosure of these vulnerabilities worked fine until 2 days onward of the targeted publish date.
On Tuesday, October 20th, at about 15:00 UTC, the two CVE IDs began circulating on online forums and social media. They came alongside a incorrect publish period and a incorrect CVSS mark of 10.0 (the genuine mark is 9.2). No specialized particulars leaked. In response, the PHP project brought its pre-announcement onward and published it at 19:30 UTC. It additionally moved the publish from October 22nd, 14:00 UTC, to October 21st, 14:00 UTC. Distributors were motionless packaging the fix, so releasing immediately would have remaining many users without an uncomplicated way to update. Moving the publish onward by one day was the finest colony between acting quickly, giving group period to prepare, and making certain everyone had a uncomplicated update way whenever the vulnerabilities were disclosed.
As a outcome of the leak and pre-announcement about 20:00 UTC, Calif, among the safety firms that had reported the issues mistakenly published a video. It showed their evidence of idea operating against a figure of targets and revealed a few additional, although limited, particulars concerning the vulnerabilities. Copies of the deleted video started circulating on social media shortly after. The video contributed to accelerated betterment of assorted PoCs (exploitation evidence of concepts), which afterward risen circulation on October 21st.
Mitigation direction we started providing to a few crucial infrastructure providers about Oct 20th 23:00 UTC, may have leaked as well. The PHP safety squad closely monitored and inspected appearing PoCs following the leak but did not acknowledge any functional exploits at the period of release/public disclosure.
On October 21st at 07:41 UTC, additional than six hours before the coordinated release, Chainguard unilaterally bankrupt the embargo and published built images containing the fix. Like another distributors, Chainguard had received the place ongoing so its users could update the instant the vulnerabilities were disclosed. Any attacker could now study the fix in binary form during all another PHP person was motionless waiting for the release. This disregarded weeks of activity by many parties toward a coordinated disclosure.
A carefully optimistic outlook
Today's publish shows the advancement we’re making in how PHP safety is handled. Once the complete effect of the OOM issue was understood in August, the safety team, the foundation, and the publish managers delivered a fix for this deeply established issue throughout all supported branches, and distributions and LTS vendors received the place onward of period so their users can update quickly.
We are assured that a grave exposure alongside a fix stuck on difficult trade-offs would now attain the PHP Foundation guidance much sooner, as we’re changing processes so guidance can assistance steer the circumstance to a timely resolution. We are now prioritizing measures to create certain vulnerabilities that need likewise complex fixes get resolved faster whenever they are reported in the future. The PHP Foundation and the PHP safety squad learned a lot in the final weeks and volition activity to rotate their experiences into enduring repeatable processes.
What we need from you
PHP runs a ample portion of the web, including authorities services, online stores, banks, media sites, and much of the application that businesses depend on all day. Yet safety activity on PHP itself motionless depends on a small collection of foundation-funded developers and a small unpaid help.
Tools now discover bugs faster than ever, for defenders and attackers alike, and the figure of reports volition keep growing. What tools cannot do is decide on the correct fix for a long-standing scheme decision in the engine, measure the compatibility trade-offs, and assessment the patch. Making those decisions takes informed engineers who cognize the complete PHP codebase, and today there are too few of them.
A center part of the PHP Foundation's goal is to develop the figure of engineers alongside profound cognition of the PHP codebase and provision the safety squad the resources it needs. We can lone accomplish this goal alongside backing from those who depend on PHP:
- Companies that build products and services on PHP: delight sponsor the PHP Foundation at a flat that reflects how much you depend on it.
- Hosting providers, haze platforms, and distributions that provision PHP to millions of users.
- Governments and community institutions whose services run on PHP. The German Sovereign Tech Agency's backing of the 2024 audit shows what community funding can achieve, and we need additional of it, on a sustained basis.
Sponsoring the PHP Foundation is the most straightforward way to justify structural issues akin the OOM exposure are addressed sustainably, before they rotate into emergencies. Become a sponsor at thephp.foundation/sponsor, and if your institution would akin to conversation concerning a larger commitment, get in touch.
Thank you
Thank you to the PHP safety team, volunteers and PHP Foundation contractors alike, the publish managers, and the bundle maintainers at distributions and LTS vendors who made these releases possible. Thank you to Calif, particularly Ryan A, Wiz, OpenAI Codex Security, particularly Amy Burnett, OSTIF, and Quarkslab for their investigation and liable disclosure; to Alpha-Omega, OpenAI, and Anthropic for giving the squad admission to their tools and backing several of the safety work; to the Sovereign Tech Agency for backing the 2024 audit; and to all of our sponsors, whose assistance made this activity possible.
